# Belgian bank phish uses IPv4-mapped IPv6 address

Published: 2026-06-19 · Severity: low · Sectors: financial-services
Canonical: https://vorant.io/reports/d9b544f6-4194-5b7c-a1d6-da7044d5706a/belgian-bank-phish-uses-ipv4-mapped-ipv6-address

> Attackers bypass simple regex security controls by embedding IPv4 addresses as IPv4-mapped IPv6 literals (::ffff:5511:74be) to deliver eBanking phishing pages.

A phishing campaign targeting a major Belgian bank employs an unusual obfuscation technique to evade basic URL detection controls. The malicious link uses IPv4-mapped IPv6 address notation (hxxp://[::ffff:5511:74be]/kWC5PHA1) where the IPv6 literal format masks the actual IPv4 destination. When expanded per RFC 4291, the address 0000:0000:0000:0000:0000:ffff:5511:74be reveals the embedded IPv4 address 85.17.116.190, as the trailing hex groups 5511 and 74be represent the four IPv4 octets in hexadecimal.

The technique exploits simple regular expression-based security controls that may fail to parse this valid but uncommon URL format. The initial URL redirects to the actual phishing kit hosted at hxxps://3439-aanmelden.verificatie.qzz.io/mon-belfius. Notably, the IPv4-mapped address has no associated DNS record, further complicating detection. While the underlying phishing campaign itself is conventional, the delivery mechanism demonstrates attackers' continued evolution in bypassing automated defenses.

## Detection guidance (public sample)

### Phishing URL Using IPv4-Mapped IPv6 Address Notation

ATT&CK: T1027

Detects HTTP requests or logged URLs containing an IPv4-mapped IPv6 literal (e.g. http://[::ffff:x:x]/) used to obfuscate the true destination IP and evade simple regex-based URL filters. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Phishing URL Using IPv4-Mapped IPv6 Address Notation
id: 75ff5fe1-d3a0-5586-a991-e07d79980be3
status: experimental
description: 'Detects requests or logged URLs that use IPv4-mapped IPv6 address notation
  (::ffff:xxxx:xxxx) inside a bracketed literal host.

  This format is technically valid but rarely used by legitimate sites, and has been
  observed as an obfuscation technique in phishing campaigns to bypass simple URL/IP
  regex-based security controls.

  '
references:
- RFC 4291
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
    - '[::ffff:'
    - ://[::ffff
  condition: selection
fields:
- c-uri
- c-useragent
- src_ip
falsepositives:
- Internal diagnostic tooling or network testing scripts that intentionally craft
  IPv4-mapped IPv6 literals
- Legacy or dual-stack applications explicitly configured to test IPv6 transition
  mechanisms
level: medium
tags:
- attack.t1027
- attack.t1566.002
author: Vorant
```

### HTTP Request to Bracketed IPv6 Literal Host With No Prior DNS Resolution

ATT&CK: T1566.002

Detects outbound HTTP(S) connections where the request Host/URL is a bracketed IPv6 literal rather than a domain name, a pattern used by a phishing redirector to mask an embedded IPv4 destination and avoid domain reputation checks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HTTP Request to Bracketed IPv6 Literal Host With No Prior DNS Resolution
id: 13916a3b-7d17-5555-a32c-dbe86f54d081
status: experimental
description: 'Detects web/proxy log entries where the requested URL host portion is
  a bracketed IPv6 literal (e.g. [::ffff:5511:74be]) instead of a resolvable domain
  name.

  Legitimate browsing rarely targets raw IPv6 literals directly, and phishing kits
  have used this format specifically because it lacks an associated DNS record, complicating
  detection and correlation.

  '
logsource:
  category: proxy
detection:
  selection:
    c-uri|re: ://\[[0-9a-fA-F:]+\]/
  filter_common_ipv6_services:
    c-uri|contains:
    - ://[::1]
    - ://[fe80
  condition: selection and not filter_common_ipv6_services
fields:
- c-uri
- dst_ip
- src_ip
falsepositives:
- Internal network management interfaces addressed by link-local or loopback IPv6
  literals
- Developer or QA testing directly against IPv6 literal endpoints
level: medium
tags:
- attack.t1566.002
- attack.t1027
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Source reporting: https://isc.sans.edu/diary/rss/33090

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d9b544f6-4194-5b7c-a1d6-da7044d5706a/belgian-bank-phish-uses-ipv4-mapped-ipv6-address.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup